CVE-2023-0091

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-00924.9An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from th CVE-2023-00938.8Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow CVE-2023-00945.4The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them b CVE-2023-00955.4The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-00965.4The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/p CVE-2023-00975.4The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options be CVE-2023-00988.8The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions CVE-2023-00996.1The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading CVE-2023-01008.8In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HT CVE-2023-01018.8A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated att CVE-2023-01029.1LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker t CVE-2023-01037.5If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communic